All features

Two-step sign-in

Protect your sign-in with a code from an authenticator app or a passkey - and require it for everyone in your firm.

A password can be guessed, reused or phished, and an emailed link is only as safe as the mailbox. Two-step sign-in adds a second proof that it's you: after your password or emailed link, Squire asks for a six-digit code from an authenticator app on your phone or computer. Sign in with a passkey instead and you're done in one step - a passkey already checks your fingerprint, face or PIN, so it counts as both.

After a password, Squire's two-step sign-in page asks for the six-digit code an authenticator app shows, with a passkey offered as the alternative. An owner then requires two-step sign-in for the whole firm from 30 October in Organization Settings, and the Team tab shows which members sign in with a passkey, an authenticator app, or a password only.

Set it up for yourself

  1. 1

    Open your security settings

    Go to Settings → Security and choose Set up an authenticator app.

  2. 2

    Scan the code with an app you already have

    Any of the Passwords app on iPhone, iPad and Mac, Google Authenticator, Microsoft Authenticator, 1Password or Authy will do. On a Mac, paste the setup key instead of scanning.

  3. 3

    Save your recovery codes

    You get ten single-use codes for the day your phone is lost. Keep them somewhere safe, such as your password manager.

Require it for your firm

Owners and admins can require two-step sign-in from everyone who works in the firm - members, counsel and guests you've shared work with.

  • Choose the date it starts, in Organization Settings → Security. Everyone who isn't set up yet is emailed, and nothing is blocked until that date.
  • On the Team tab, owners and admins see who signs in with a passkey, an authenticator app, or a password only - members and counsel.
  • Enterprise firms can sign in with their own identity provider instead - single sign-on is set up with you, by arrangement.
  • From then on, a password or an emailed link alone doesn't open your firm's work - in the browser, the API or connected AI tools. No one is removed: they're asked to confirm it's them, or to set one up first.

Squire doesn't send codes by text message - SMS codes can be intercepted, so we don't offer them.

Lost your phone and your recovery codes? Squire support resets two-step sign-in only after confirming who you are with your firm.

Set up two-step sign-in